Javascript settings are now using application/json to be CSP compatible

In Drupal 7 and 8 drupalSettings have traditionally been loaded via inline javascript.

To enable core to support a Content Security Policy (CSP) all inline javascript must be removed as it is incompatible with having a CSP that offers good cross-browser protection against cross-site scripting (XSS) vulnerabilities.

Therefore javascript settings are now put into the page as pure JSON data, which is CSP compatible.

Before

    <script>
<!--//--><![CDATA[//><!--
var drupalSettings = {"path":{"baseUrl":"\/","scriptPath":"\/index.php","pathPrefix":""}, ...};
//--><!]]>
</script>

After

<script type="application/json" data-drupal-selector="drupal-settings-json">
{"path":{"baseUrl":"\/","scriptPath":"\/index.php","pathPrefix":""}, ...}
</script>

The settings are then put into the usual window.drupalSettings JS variable by using a drupalSettingsLoader.js that is aggregated with the rest of the javascript.

So for most Javascript this change is 100% transparent.

In case someone needs access to the settings earlier, they can use the following code to access the drupalSettings themselves:

var settingsElement = document.querySelector('script[type="application/json"][data-drupal-selector="drupal-settings-json"]');
var drupalSettings = JSON.parse(settingsElement.textContent);

This should only be needed in very rare edge cases however.